In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: reject out-of-range OCF values The raw HCI socket security… (CVE-2026-98460)

The Linux kernel's Bluetooth raw HCI socket security filter maintains 128 OCF bits per supported OGF but incorrectly masks the 10-bit OCF with 127 before command lookup. This allows an unprivileged socket to submit reserved OCF values that alias allowlisted commands modulo 128, potentially bypassing security filters. Although a conforming Bluetooth controller should reject reserved opcodes, the host stack must enforce security decisions based on the actual opcode sent, as controller behavior is outside its control. The fix involves rejecting OCF values that cannot be represented by the security filter rather than aliasing them onto unrelated commands.

An unprivileged user could exploit this vulnerability to bypass the Bluetooth raw HCI socket security filter by submitting reserved OCF values that alias allowlisted commands. This may lead to unauthorized Bluetooth command execution at the host level. However, the impact depends on controller behavior and the specific commands allowed by the security filter.

A fix has been implemented in the Linux kernel to reject out-of-range OCF values instead of aliasing them onto unrelated commands. Users and administrators should apply the official Linux kernel update that includes this patch to mitigate the vulnerability. No additional mitigation steps are indicated.